PublicDateAtUSN: 2016-05-05
Candidate: CVE-2016-2167
PublicDate: 2016-05-05 18:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2167
 https://subversion.apache.org/security/CVE-2016-2167-advisory.txt
 https://ubuntu.com/security/notices/USN-3388-1
 https://ubuntu.com/security/notices/USN-3388-2
Description:
 The canonicalize_username function in svnserve/cyrus_auth.c in Apache
 Subversion before 1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL
 authentication is used, allows remote attackers to authenticate and bypass
 intended access restrictions via a realm string that is a prefix of an
 expected repository realm string.
Ubuntu-Description:
 Daniel Shahaf and James McCoy discovered that Subversion did not
 properly verify realms when using Cyrus SASL authentication. A
 remote attacker could use this to possibly bypass intended access
 restrictions.
Notes:
Bugs:
Priority: low
Discovered-by: Daniel Shahaf and James McCoy
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N [6.8 MEDIUM]

Patches_subversion:
upstream_subversion: released (1.9.4-1)
precise_subversion: ignored (reached end-of-life)
precise/esm_subversion: released (1.6.17dfsg-3ubuntu3.7)
trusty_subversion: released (1.8.8-1ubuntu3.3)
trusty/esm_subversion: DNE (trusty was released [1.8.8-1ubuntu3.3])
vivid/stable-phone-overlay_subversion: DNE
vivid/ubuntu-core_subversion: DNE
wily_subversion: ignored (reached end-of-life)
xenial_subversion: released (1.9.3-2ubuntu1.1)
esm-infra/xenial_subversion: released (1.9.3-2ubuntu1.1)
yakkety_subversion: not-affected (1.9.4-1ubuntu1)
zesty_subversion: not-affected (1.9.4-1ubuntu1)
artful_subversion: not-affected (1.9.4-1ubuntu1)
devel_subversion: not-affected (1.9.4-1ubuntu1)